CVE-2026-56278 Details
Description
Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses a weak hardcoded default secret ('flowise') for the express-session middleware when the EXPRESS_SESSION_SECRET environment variable is not set (packages/server/src/enterprise/middleware/passport/index.ts). Because this default secret is publicly visible in the source code, an attacker can forge valid signed session cookies to impersonate any user and bypass authentication.
A session hijacking vulnerability exists in Flowise versions prior to 3.1.0, specifically in versions 3.0.13 and earlier. The issue arises because the application uses a weak hardcoded default secret, 'flowise', for the express-session middleware when the EXPRESS_SESSION_SECRET environment variable is not set. This default secret, which is publicly visible in the source code, allows attackers to forge valid signed session cookies, impersonate any user, and bypass authentication. The vulnerability is located in the passport middleware of the server package.
Users are advised to set the EXPRESS_SESSION_SECRET environment variable with a strong, random value. The application should be configured to throw an error on startup if this variable is not set. It is recommended to use cryptographically strong random strings, with a minimum length of 256 bits.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 1, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-2qqc-p94c-hxwh | [email protected] | MitigationVendor Advisory |
| https://www.vulncheck.com/advisories/flowise-session-hijacking-via-weak-default-express-session-secret | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-798 | Use of Hard-coded Credentials | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| flowiseai flowise | < 3.1.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 6, 2026 | Initial Analysis | [email protected] |
| Jul 1, 2026 | CVE Modified | CISA-ADP |
| Jun 30, 2026 | New CVE Received | [email protected] |